65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee

Analysis

max time kernel
178s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:01

Target

65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll
Size

72KB
MD5

0422af5e1d4f29423dbead49e76fd460
SHA1

a35a04089b3599844ccbf93afde418d453933887
SHA256

65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee
SHA512

86359b653c9e47e2d5b5d47c8e10086db8a1fe0f70b09ac101d92ea317e02b70bebeec7a86e3ee3e9584718d448a49a7758a85e05a8e68fc139a72b4376f7452
SSDEEP

768:9doYItUVp4TbQcthznmqfUyML/iAPeQjmhILuaGF8AHpkSqTps:9doXtUETRUBP9uBtHFqTq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	4204	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4204	2544	rundll32.exe	78
PID 2544 wrote to memory of 4204	2544	rundll32.exe	78
PID 2544 wrote to memory of 4204	2544	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c61c84b2b6473044304e9bfd22df33f3b98fa90db4fcc59056b85bd27f50ee.dll,#1
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 560
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 4204
1⤵
PID:5028